Analysis
-
max time kernel
205s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 14:20
Static task
static1
Behavioral task
behavioral1
Sample
89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe
Resource
win10v2004-20221111-en
General
-
Target
89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe
-
Size
636KB
-
MD5
c9ffc3cf9644b18d3b9177f3538d5777
-
SHA1
4b07b514e46bdc9d1b7a4d141972390db368b5f0
-
SHA256
89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33
-
SHA512
8c79fe2a251d2baa6b2d7eb8bbc99ea8112e44e4cabf8083cb3a762b03cc75c635927f2652ea48aaa2f2d57d1b472a612157c897c660f5e5efa6991396031109
-
SSDEEP
12288:P3N7+8qyRWMzSfXPzwDevratVILPqbP/E:PkRp4Snz7atVpP
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\968006\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" system.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe File opened for modification C:\Windows\system32\drivers\etc\hosts system.exe -
Executes dropped EXE 2 IoCs
pid Process 2024 system.exe 1692 system.exe -
Loads dropped DLL 1 IoCs
pid Process 684 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows System = "\"C:\\ProgramData\\968006\\system.exe\"" system.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clientsvr.exe system.exe File created C:\Windows\SysWOW64\clientsvr.exe system.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1716 set thread context of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 2024 set thread context of 1692 2024 system.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 2024 system.exe 2024 system.exe 1692 system.exe 1692 system.exe 1692 system.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 684 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe Token: SeDebugPrivilege 2024 system.exe Token: SeDebugPrivilege 1692 system.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1692 system.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 1716 wrote to memory of 684 1716 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 28 PID 684 wrote to memory of 2024 684 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 30 PID 684 wrote to memory of 2024 684 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 30 PID 684 wrote to memory of 2024 684 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 30 PID 684 wrote to memory of 2024 684 89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe 30 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31 PID 2024 wrote to memory of 1692 2024 system.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe"C:\Users\Admin\AppData\Local\Temp\89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe"C:\Users\Admin\AppData\Local\Temp\89e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:684 -
C:\ProgramData\968006\system.exe"C:\ProgramData\968006\system.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\ProgramData\968006\system.exe"C:\ProgramData\968006\system.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
636KB
MD5c9ffc3cf9644b18d3b9177f3538d5777
SHA14b07b514e46bdc9d1b7a4d141972390db368b5f0
SHA25689e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33
SHA5128c79fe2a251d2baa6b2d7eb8bbc99ea8112e44e4cabf8083cb3a762b03cc75c635927f2652ea48aaa2f2d57d1b472a612157c897c660f5e5efa6991396031109
-
Filesize
636KB
MD5c9ffc3cf9644b18d3b9177f3538d5777
SHA14b07b514e46bdc9d1b7a4d141972390db368b5f0
SHA25689e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33
SHA5128c79fe2a251d2baa6b2d7eb8bbc99ea8112e44e4cabf8083cb3a762b03cc75c635927f2652ea48aaa2f2d57d1b472a612157c897c660f5e5efa6991396031109
-
Filesize
636KB
MD5c9ffc3cf9644b18d3b9177f3538d5777
SHA14b07b514e46bdc9d1b7a4d141972390db368b5f0
SHA25689e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33
SHA5128c79fe2a251d2baa6b2d7eb8bbc99ea8112e44e4cabf8083cb3a762b03cc75c635927f2652ea48aaa2f2d57d1b472a612157c897c660f5e5efa6991396031109
-
Filesize
2KB
MD51cca24ab81c8b433dbf256fb95564a26
SHA1565b8147705862cb0fff85591a48a9fa6859dc31
SHA256ca9af0bb473d3b51f7b47ddbd7ee75e8e88342ba35e169f3cd1666bf9176215a
SHA5123bc3179fcc8e74da763a42401fa8e99d33a1181fda8f8695c4394a2bcc54690dd85b9d4b9ea59bfc7ddfbd6f1f055179bf79a93919d1e384e16f28029ea3e839
-
Filesize
636KB
MD5c9ffc3cf9644b18d3b9177f3538d5777
SHA14b07b514e46bdc9d1b7a4d141972390db368b5f0
SHA25689e8dbf09685f9de65e186fd7487374b7f081dbbbca86360a9047fb334235c33
SHA5128c79fe2a251d2baa6b2d7eb8bbc99ea8112e44e4cabf8083cb3a762b03cc75c635927f2652ea48aaa2f2d57d1b472a612157c897c660f5e5efa6991396031109